August 2017 - iot-wg - mailman.ripe.net

[iot-discussion] RIPE IoT Roundtable: agenda online (21 September, Leeds)
by Marco Hogewoning 18 Aug '17

18 Aug '17

Dear colleagues, We have just posted an updated agenda for the upcoming IoT Roundtable meeting, which will be held in Leeds on 21 September: https://www.ripe.net/participate/meetings/roundtable/september-2017/ripe-io… Many thanks to all the enthusiastic responses and people who already volunteered to contribute. Looking forward to a fruitful and constructive dialogue on what we together can contribute to keep the Internet a safe and secure environment. Please note it is not yet too late to register and participate in the discussion, more information about the logistics and a link to the registration form is available on our website: https://www.ripe.net/participate/meetings/roundtable/september-2017/ripe-io… Hope to see you all in Leeds, Marco Hogewoning -- External Relations - RIPE NCC

1 0

Re: [iot-discussion] Proposed US legislation
by Richard Lamb 10 Aug '17

10 Aug '17

Thank you for that. I will read more thoroughly. But iIMHO the excerpt sounds a bit one-sided towards telco/itu/nb-iot/lte-m ‘ish as you elude to with your sim card reference. I guess I do a bit of delineation between wide-area RF (telco/sigfox) and near range (wifi,bt,..). Above that phys layer there seems to be some common use of traditional internet stuff (ip, dns, tls, mqtt) but past that i still see a morass of custom protocols for the “controllers” that each use their own device identity formats. From what I hear from trade shows like CES, I think that will not change, i.e., there will remain a common way to communicate but competing APPs each with their own identifiers (and encryption approaches). From my admittedly simple research (I continue to buy various iot devices and then do packet traces. Picture of what I see below) I have not seen a scalability issue for the typical wifi, ble via gateway connected devices to the cloud based (many in AWS) broker+controllers. –Rick [cid:image002.jpg@01D3104A.53960000]

2 2

[iot-discussion] Proposed US legislation
by Gordon Lennox 09 Aug '17

09 Aug '17

"Specifically, the Internet of Things (IoT) Cybersecurity Improvement Act of 2017 would: Require vendors of Internet-connected devices purchased by the federal government ensure their devices are patchable, rely on industry standard protocols, do not use hard-coded passwords, and do not contain any known security vulnerabilities. Direct the Office of Management and Budget (OMB) to develop alternative network-level security requirements for devices with limited data processing and software functionality. Direct the Department of Homeland Security’s National Protection and Programs Directorate to issue guidelines regarding cybersecurity coordinated vulnerability disclosure policies to be required by contractors providing connected devices to the U.S. Government. Exempt cybersecurity researchers engaging in good-faith research from liability under the Computer Fraud and Abuse Act and the Digital Millennium Copyright Act when in engaged in research pursuant to adopted coordinated vulnerability disclosure guidelines. Require each executive agency to inventory all Internet-connected devices in use by the agency." https://www.warner.senate.gov/public/index.cfm/pressreleases?id=06A5E941-FB… The legislation does not try and define “things” and instead uses the term “Internet-connected devices”. I think this is a good approach. It is though limited to devices purchased by the Federal government and so does not include devices bought by companies and/or consumers. Various US agencies are seen as having a role. Which would be the equivalent agencies in the EU? Gordon

5 13

[iot-discussion] EC3-ENISA IoT Security Conference
by Gordon Lennox 07 Aug '17

07 Aug '17

<< As a new initiative that aims to raise awareness on the security implications of the Internet of Things (IoT), the conference will enable a multi-stakeholder discussion by bringing together experts from cybercrime units, CSIRTs, international organisations, private industry, regulatory agencies, and academia. The discussions will be structured around the following themes: • IoT threat landscape and defence • Industry 4.0 and IoT experts • The way forward The conference will officially open on 18 October 2017 at 12.00h and end on 19 October 2017 at 17.30h, and will be hosted at the Europol headquarters in The Hague, the Netherlands. >> https://www.enisa.europa.eu/events/enisa-ec3-internet-of-things-conference/… The event is by invitation only. Anyone going? If not then perhaps NCC could be “invited”? And perhaps they could then report back? :-) Gordon

2 1

[iot-discussion] Reminder: RIPE IoT Roundtable 21 September in Leeds (UK)
by Marco Hogewoning 02 Aug '17

02 Aug '17

Dear colleagues, I have talked to many of you personally about our upcoming meeting in Leeds and happy to see many of you also have registered. If you are thinking about coming over, but haven’t registered, please do so. We still have quite a few places left, but would like to get a sense of how much coffee we need to order. As mentioned in our announcement, the goal of this meeting is to discuss the possible interactions between RIPE and the Internet of Things industry. What are the concerns in our community, for instance with regards to poorly maintained devices and attacks such as the Mirai botnet. What can the RIPE NCC and RIPE do in this space, which actions or outputs could help to make the IoT environment more safe? We will post an updated agenda soon, several people have approached us with ideas and examples. But there is still space for more, so if you have any ideas or examples that can help to shape the debate, please do contact us. Hope to see you all in Leeds, Marco Hogewoning -- External Relations - RIPE NCC PS: on a related note, we also need a plan for the 90 minute slot during RIPE75 :)

1 0